Prompt Injection

Prompt injection is a vulnerability in which input to a large language model alters its behavior or output in ways its developer did not intend, for example making it ignore its instructions, disclose data or take actions it should not. OWASP ranks it first in its Top 10 for LLM applications as LLM01:2025.

OWASP separates direct injection, where the user's own prompt carries the instructions, from indirect injection, where they arrive in content the model reads, such as a web page, file, email or tool result. Indirect injection is the identity problem, because an agent acts with its user's or its own credentials, so instructions hidden in fetched content can make it read secrets and send them out. In October 2026 Adversa AI showed an encrypted web page steering GitHub Copilot CLI into leaking a .env file, and Zenity Labs showed one prompt making an Amazon Bedrock AgentCore agent return its execution role credentials. No input filter catches it reliably, so the containment is on the identity side: short-lived, least-privilege credentials for each agent, no standing secrets within its reach, and human confirmation before sensitive actions.

See also: agent instruction injection, agentic identity, securing AI agent identities, instance metadata service